[ishaanxgupta]

Browser sign-in currently opens console auth/connect and saves a long-lived sm_ API key, read once at plugin load. Login now uses the Supermemory OAuth 2.1 authorization server, the same flow as the Claude Code and Codex plugins.

• Discover the authorization server, register a public client named "Supermemory for OpenCode" (callback 127.0.0.1:19880), and reuse the registration across logins.
• Authorize with S256 PKCE, random state and issuer validation. Store access and refresh tokens atomically with owner-only permissions, bound to the API URL, issuer and MCP resource.
• Credentials are resolved per request instead of at module load, so running OpenCode sessions pick up a login or logout without a restart. The v1 and v2 hooks stay registered and check auth per event.
• Refresh serializes across processes and always saves the rotated tokens, even when a caller stops waiting.
• login migrates a saved API key; logout revokes the refresh token. Status shows auth type and client ID only.
• SUPERMEMORY_API_KEY, a config apiKey or a saved {apiKey} file keep precedence and keep working unchanged.

Verified live against the mono PR preview: consent shows "Supermemory for OpenCode" as a Plugin, a tag-scoped grant allows the granted tag and returns 403 for others, refresh rotates tokens, and logout revokes the refresh token.

Requires https://github.com/supermemoryai/mono/pull/3087 for the consent screen to name the plugin and attribute requests to its OAuth client. Same design as supermemoryai/claude-supermemory#121 and supermemoryai/codex-supermemory#71.